{"record":{"id":"ad35e8b5b38ef8c7","repo":"dgraph-io/dgraph","slug":"unable-to-get-encryption-keys","errorCode":null,"errorMessage":"unable to get encryption keys","messagePattern":"unable to get encryption keys","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"worker/restore_map.go","lineNumber":765,"sourceCode":"\tcreds := getCredentialsFromRestoreRequest(req)\n\th, err := NewUriHandler(uri, creds)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tmanifests, err := getManifestsToRestore(h, uri, req)\n\tif err != nil {\n\t\treturn nil, errors.Wrapf(err, \"cannot retrieve manifests\")\n\t}\n\tglog.Infof(\"Got %d backups to restore \", len(manifests))\n\n\tcfg, err := getEncConfig(req)\n\tif err != nil {\n\t\treturn nil, errors.Wrapf(err, \"unable to get encryption config\")\n\t}\n\tkeys, err := x.GetEncAclKeys(cfg)\n\tif err != nil {\n\t\treturn nil, errors.Wrapf(err, \"unable to get encryption keys\")\n\t}\n\n\tmapper := &mapper{\n\t\tbuf:       z.NewBuffer(mapFileSz, \"Restore.Buffer\"),\n\t\tthr:       y.NewThrottle(3),\n\t\tbufLock:   &sync.Mutex{},\n\t\tcloser:    z.NewCloser(1),\n\t\treqCh:     make(chan listReq, 3),\n\t\trestoreTs: req.RestoreTs,\n\t\tmapDir:    mapDir,\n\t\tszHist:    z.NewHistogramData(z.HistogramBounds(10, 32)),\n\t}\n\n\tnumGo := 8\n\tg, ctx := errgroup.WithContext(mapper.closer.Ctx())\n\tfor range numGo {\n\t\tg.Go(func() error {\n\t\t\treturn mapper.processReqCh(ctx)","sourceCodeStart":747,"sourceCodeEnd":783,"githubUrl":"https://github.com/dgraph-io/dgraph/blob/759e242be62c91f8d084da06ad0c8d21256d9c07/worker/restore_map.go#L747-L783","documentation":"RunMapper wraps failures from x.GetEncAclKeys with 'unable to get encryption keys'. This step derives the ACL encryption key(s) from the encryption config (required when the cluster uses ACLs with encrypted passwords); failure here aborts the restore before mapping begins.","triggerScenarios":"x.GetEncAclKeys(cfg) returns an error — typically the ACL key was not found in the encryption config, the key material is malformed, or the KMS provider call inside fails.","commonSituations":"Restoring into an ACL-enabled cluster without the same enc_key/acl key used at backup time; key mismatch after key rotation; passing a config missing the ACL key field.","solutions":["Check the wrapped cause for the specific key retrieval failure.","Provide the same ACL encryption key (enc_key) used by the source cluster in the restore request/config.","Ensure the key provider (vault/kms) is reachable and credentials are valid.","Keep key IDs stable across backup and restore; if keys were rotated, use the key version active at backup time."],"exampleFix":"// before\nreq := &pb.RestoreRequest{Location: loc} // ACL cluster, ACL key absent\n// after\nreq := &pb.RestoreRequest{Location: loc, EncKey: aclEncKey} // supply the same ACL key as source cluster","handlingStrategy":"validation","validationCode":"if usingAcl && aclEncKey == nil {\n    return errors.New(\"ACL-enabled cluster: the ACL encryption key must be supplied\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Back up and version the ACL enc_key with cluster config","Use the key version active when the backup was taken","Test key retrieval before the restore window"],"tags":["dgraph","restore","encryption","acl","config"],"backgroundTag":"encryption-key-unavailable","analyzedSha":"759e242be62c91f8d084da06ad0c8d21256d9c07","analyzedAt":"2026-09-01T14:42:12.034Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}